Internal incident reporting rules: how fast and to whom

Tell every employee to report a suspected incident promptly to one named channel, with a time expectation and a no-blame promise. Then keep a record of every report, including false alarms. Speed of reporting often decides how much damage an incident does.

What the controls ask

NIST SP 800-53 IR-6 says personnel should report suspected incidents to the incident response capability within a time period the organisation defines, and that the organisation passes incident information to designated authorities. IR-5 asks for records of incidents, with status and the information needed for forensic work, supporting review of trends and response effectiveness. Which incidents get reported, how fast and to whom depends on law, regulation and internal policy, as IR-6's guidance notes.

Write the employee rule in plain words

Put it on one page:

1. What to report. Lost or stolen device, strange login prompt, a phishing email you clicked, a file sent to the wrong person, a laptop behaving oddly, a secret pasted in public. Add "if unsure, report it".
2. Where. One email alias, one chat channel and one phone number. Fewer options mean fewer excuses.
3. When. "Immediately, and within one hour of noticing" is easy to remember. Choose your own number.
4. What happens next. Someone acknowledges within a defined time.
5. No blame. Clicking a phishing link is not punished. Hiding it is.

See also a phishing reporting process employees will use.

Triage on the receiving end

Reports are only useful if someone looks. Set an on-call rota and an acknowledgement target. A short intake form helps: who, what, when, which device or system, what was done already, and whether any data might be involved.

Decide in advance who may declare an incident and how severity is set. Link this to your incident response plan.

Reporting outward

Some incidents trigger duties to customers, regulators or insurers, and contracts often set deadlines. The policy should name who decides on external notification, and should tell staff not to contact outsiders themselves. Which duties apply depends on your jurisdiction and agreements, so involve counsel. For one example of a clock, see the GDPR 72 hour breach notification clock.

IR-6(3) also describes sharing incident information with product and service providers and other supply chain participants where related components are affected. If a vendor is involved in your incident, plan how to reach them.

Records and metrics

Keep a register of every report: date, reporter, summary, severity, decision, closure date. IR-5 notes records can draw on user and administrator reports as well as monitoring. Review it quarterly for trends: repeated phishing against one team, repeated lost devices, slow acknowledgement.

Count false alarms as a success measure. A healthy programme gets many.

Common failures

• Staff do not know where to report.
• The channel is checked once a day.
• Managers discourage reports to keep numbers low.
• Reports sit in a personal inbox of someone on holiday.

Safeguard's compliance and evidence automation can help gather incident register exports and training records for audits.

Quick check

Sources

• IR-6 Incident Reporting, NIST SP 800-53 Rev. 5
• IR-5 Incident Monitoring, NIST SP 800-53 Rev. 5

Last reviewed: 19 October 2026.